registry / @aswless_854771076/ai_short_studio_cli / 0.1.94
@aswless_854771076/ai_short_studio_cli@0.1.94
VVICAT 无限画布项目命令行工具
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe automatic postinstall installation of package-owned content into the user’s Codex skills directory is a guarded first-party agent extension lifecycle risk. The inspected OAuth code follows explicit login flows and did not establish unrelated credential disclosure.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation, unless the skip environment variable is set or the package is installed from its own directory.
Impact
The skill becomes available to the user’s agent and may guide future agent tasks through package-specific instructions.
Mechanism
The hook copies package-bundled skill files into the configured skills root, defaulting to ~/.codex/skills.
AI rationale
The automatic postinstall installation of package-owned content into the user’s Codex skills directory is a guarded first-party agent extension lifecycle risk. The inspected OAuth code follows explicit login flows and did not establish unrelated credential disclosure.
Evidence
scripts/postinstall.mjsdist/skill/skill-manager.jsskills/using-vvicat-ai-short-studio-cli/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.mjs on install; that hook auto-installs bundled skills unless skipped or installed from the package’s own directory.
- dist/skill/skill-manager.js copies bundled skill files into the configured skills root; the default target is the user’s Codex skills directory.
- The installed skill is the package’s own VVICAT CLI guide, and it tells agents to check status and ask before updating a non-current skill.
- Google OAuth uses the Supabase client flow and returns its session to the caller.
- MemHub login is user-invoked and sends its authorization code and PKCE verifier to the configured service base URL.
Evidence against
- No inspected source showed credential forwarding to an unrelated recipient, reviewer-directed manipulation, or a remote payload channel.
- The agent-facing content is bundled with the package and describes its CLI; install safeguards skip unowned or modified skills unless forced.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/skill/skill-manager.jsView file
1Install-time code directly mutates a foreign AI-agent control surface:
L12: export function defaultSkillsRoot(target) {
L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills');
L14: }
...
L41: const backup = `${target}.backup-${process.pid}`;
L42: await mkdir(dirname(target), { recursive: true });
L43: await rm(temporary, { recursive: true, force: true });
L44: await cp(bundledSkillPath(name), temporary, { recursive: true });
L45: await writeFile(join(temporary, MANIFEST), `${JSON.stringify({ packageVersion, checksum }, null, 2)}\n`, 'utf8');
Write operation from dist/skill/sk[redacted]:
L12: export function defaultSkillsRoot(target) {
L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills');
L14: }
...
L41: const backup = `${target}.backup-
Findings
1 Critical4 High4 Medium4 Low
CriticalAi Agent Control Hijackdist/skill/skill-manager.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill/skill-manager.js
HighKnown Malware Source Similaritydist/auth/google-oauth.js
HighPrevious Version Dangerous Deltadist/auth/memhub-oauth.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @aswless_854771076/ai_short_studio_cli@0.1.94.
See all versions of @aswless_854771076/ai_short_studio_cli for other recorded verdicts.
- Review the evidence and your use of @aswless_854771076/ai_short_studio_cli@0.1.94 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.